Unreviewed, skip JIT tests if it's not enabled
[WebKit-https.git] / JSTests / ChangeLog
1 2019-01-15  Tomas Popela  <tpopela@redhat.com>
2
3         Unreviewed, skip JIT tests if it's not enabled
4
5         * stress/bit-op-with-object-returning-int32.js:
6
7 2019-01-15  Caio Lima  <ticaiolima@gmail.com>
8
9         DFGByteCodeParser rules for bitwise operations should consider type of their operands
10         https://bugs.webkit.org/show_bug.cgi?id=192966
11
12         Reviewed by Yusuke Suzuki.
13
14         * stress/bit-op-with-object-returning-int32.js: Added.
15
16 2019-01-15  Guillaume Emont  <guijemont@igalia.com>
17
18         Skip a slow test and a flakey test on arm
19
20         Unreviewed gardening.
21
22         * typeProfiler/getter-richards.js:
23         this test always times out, it used to be always skipped on arm and
24         mips, but got accidentally enabled by r237919 now that we have DFG on
25         arm. Also skipping on mips as we plan to soon enable DFG for it too.
26
27 2019-01-14  Keith Miller  <keith_miller@apple.com>
28
29         Skip type-check-hoisting-phase-hoist... with no jit
30         https://bugs.webkit.org/show_bug.cgi?id=193421
31
32         Reviewed by Mark Lam.
33
34         It's timing out the 32-bit bots and takes 330 seconds
35         on my machine when run by itself.
36
37         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js:
38
39 2019-01-14  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
40
41         [JSC] AI should check the given constant's array type when folding GetByVal into constant
42         https://bugs.webkit.org/show_bug.cgi?id=193413
43         <rdar://problem/46092389>
44
45         Reviewed by Keith Miller.
46
47         This test is super flaky. It causes crash in r238109, but it does not crash with `--useConcurrentJIT=false`.
48         It does not cause any crashes on the latest revision too. Basically, it highly depends on the timing, and
49         without this patch, the root cause is not fixed yet. If GetLocal is turned into JSConstant in AI,
50         but GetByVal does not have appropriate ArrayModes, JSC crashes.
51
52         * stress/ai-should-perform-array-check-on-get-by-val-constant-folding.js: Added.
53         (compareArray):
54
55 2019-01-14  Caio Lima  <ticaiolima@gmail.com>
56
57         [BigInt] Literal parsing is crashing when used inside a Object Literal
58         https://bugs.webkit.org/show_bug.cgi?id=193404
59
60         Reviewed by Yusuke Suzuki.
61
62         * stress/big-int-literal-inside-literal-object.js: Added.
63
64 2019-01-14  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
65
66         [JSC] Do not use asArrayModes() with Structures because it discards TypedArray information
67         https://bugs.webkit.org/show_bug.cgi?id=193372
68
69         Reviewed by Saam Barati.
70
71         * stress/typed-array-array-modes-profile.js: Added.
72         (foo):
73
74 2019-01-14  Mark Lam  <mark.lam@apple.com>
75
76         Fix all CLoop JSC test failures (including some LLInt bugs due to recent bytecode format change).
77         https://bugs.webkit.org/show_bug.cgi?id=193402
78         <rdar://problem/46012309>
79
80         Reviewed by Keith Miller.
81
82         * stress/regexp-compile-oom.js:
83         - Skip this test for !$jitTests because it is tuned for stack usage when the JIT
84           is enabled.  As a result, it will fail on cloop builds though there is no bug.
85
86 2019-01-11  Saam barati  <sbarati@apple.com>
87
88         DFG combined liveness can be wrong for terminal basic blocks
89         https://bugs.webkit.org/show_bug.cgi?id=193304
90         <rdar://problem/45268632>
91
92         Reviewed by Yusuke Suzuki.
93
94         * stress/dfg-combined-liveness-consider-terminal-blocks-bytecode-liveness.js: Added.
95
96 2019-01-11  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
97
98         [JSC] Global lexical bindings can shadow global variables if it is `configurable = true`
99         https://bugs.webkit.org/show_bug.cgi?id=193308
100         <rdar://problem/45546542>
101
102         Reviewed by Saam Barati.
103
104         * stress/const-lexical-binding-shadow-existing-global-property-ftl.js: Added.
105         (shouldThrow):
106         (shouldBe):
107         (foo):
108         (get shouldThrow):
109         * stress/const-lexical-binding-shadow-existing-global-property-tdz-ftl.js: Added.
110         (shouldThrow):
111         (shouldBe):
112         (foo):
113         (get shouldBe):
114         (get shouldThrow):
115         (get return):
116         * stress/const-lexical-binding-shadow-existing-global-property-tdz.js: Added.
117         (shouldThrow):
118         (shouldBe):
119         (foo):
120         (get shouldBe):
121         (get shouldThrow):
122         * stress/const-lexical-binding-shadow-existing-global-property.js: Added.
123         (shouldThrow):
124         (shouldBe):
125         (foo):
126         * stress/const-lexical-binding-shadowing-global-properties-and-eval-injection.js: Added.
127         (shouldThrow):
128         (shouldBe):
129         (foo):
130         * stress/global-add-function-should-not-be-shadowed-by-lexical-bindings.js: Added.
131         (shouldThrow):
132         * stress/global-static-variables-should-not-be-shadowed-by-lexical-bindings.js: Added.
133         (shouldThrow):
134         * stress/let-lexical-binding-shadow-existing-global-property-ftl.js: Added.
135         (shouldThrow):
136         (shouldBe):
137         (foo):
138         * stress/let-lexical-binding-shadow-existing-global-property-tdz-ftl.js: Added.
139         (shouldThrow):
140         (shouldBe):
141         (foo):
142         (get shouldBe):
143         (get shouldThrow):
144         (get return):
145         * stress/let-lexical-binding-shadow-existing-global-property-tdz.js: Added.
146         (shouldThrow):
147         (shouldBe):
148         (foo):
149         (get shouldBe):
150         (get shouldThrow):
151         * stress/let-lexical-binding-shadow-existing-global-property.js: Added.
152         (shouldThrow):
153         (shouldBe):
154         (foo):
155         * stress/let-lexical-binding-shadowing-global-properties-and-eval-injection.js: Added.
156         (shouldThrow):
157         (shouldBe):
158         (foo):
159
160 2019-01-11  Dominik Infuehr  <dinfuehr@igalia.com>
161
162         Enable DFG on ARM/Linux again
163         https://bugs.webkit.org/show_bug.cgi?id=192496
164
165         Reviewed by Yusuke Suzuki.
166
167         Test wasn't really skipped before moving the line with skip
168         to the top.
169
170         * stress/regress-192717.js:
171
172 2019-01-10  Commit Queue  <commit-queue@webkit.org>
173
174         Unreviewed, rolling out r239825.
175         https://bugs.webkit.org/show_bug.cgi?id=193330
176
177         Broke tests on armv7/linux bots (Requested by guijemont on
178         #webkit).
179
180         Reverted changeset:
181
182         "Enable DFG on ARM/Linux again"
183         https://bugs.webkit.org/show_bug.cgi?id=192496
184         https://trac.webkit.org/changeset/239825
185
186 2019-01-10  Dominik Infuehr  <dinfuehr@igalia.com>
187
188         Enable DFG on ARM/Linux again
189         https://bugs.webkit.org/show_bug.cgi?id=192496
190
191         Reviewed by Yusuke Suzuki.
192
193         Test wasn't really skipped before moving the line with skip
194         to the top.
195
196         * stress/regress-192717.js:
197
198 2019-01-08  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
199
200         Array.prototype.flat/flatMap have a minor bug in ArraySpeciesCreate
201         https://bugs.webkit.org/show_bug.cgi?id=193127
202
203         Reviewed by Saam Barati.
204
205         * stress/array-species-create-should-handle-masquerader.js: Added.
206         (shouldThrow):
207         * stress/is-undefined-or-null-builtin.js: Added.
208         (shouldBe):
209         (isUndefinedOrNull.vm.createBuiltin):
210
211 2019-01-08  Tadeu Zagallo  <tzagallo@apple.com>
212
213         LLInt put_by_id uses the wrong load instruction for loading flags from the metadata
214         https://bugs.webkit.org/show_bug.cgi?id=193221
215
216         Reviewed by Mark Lam.
217
218         * stress/put-by-id-flags.js: Added.
219         (f):
220         (g):
221         (numberOfDFGCompiles):
222
223 2019-01-04  Tadeu Zagallo  <tzagallo@apple.com>
224
225         Baseline version of get_by_id may corrupt metadata
226         https://bugs.webkit.org/show_bug.cgi?id=193085
227         <rdar://problem/23453006>
228
229         Reviewed by Saam Barati.
230
231         * stress/get-by-id-change-mode.js: Added.
232         (forEach):
233
234 2019-01-02  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
235
236         [JSC] Optimize Object.prototype.toString
237         https://bugs.webkit.org/show_bug.cgi?id=193031
238
239         Reviewed by Saam Barati.
240
241         * stress/object-tostring-changed-proto.js: Added.
242         (shouldBe):
243         (test):
244         * stress/object-tostring-changed.js: Added.
245         (shouldBe):
246         (test):
247         * stress/object-tostring-misc.js: Added.
248         (shouldBe):
249         (test):
250         (i.switch):
251         * stress/object-tostring-other.js: Added.
252         (shouldBe):
253         (test):
254         * stress/object-tostring-untyped.js: Added.
255         (shouldBe):
256         (test):
257         (i.switch):
258
259 2019-01-03  Ross Kirsling  <ross.kirsling@sony.com>
260
261         test262-runner misbehaves when test file YAML has a trailing space
262         https://bugs.webkit.org/show_bug.cgi?id=193053
263
264         Reviewed by Yusuke Suzuki.
265
266         * test262/expectations.yaml:
267         Mark two dozen tests as passing (and correct the output of another).
268
269 2018-12-30  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
270
271         Unreviewed, JSTests gardening with memoryLimited
272
273         * stress/string-overflow-createError.js:
274
275 2018-12-30  Ross Kirsling  <ross.kirsling@sony.com>
276
277         [JSC] Identifier validity should be based on ID_Start / ID_Continue properties
278         https://bugs.webkit.org/show_bug.cgi?id=193050
279
280         Reviewed by Yusuke Suzuki.
281
282         * test262.yaml:
283         * test262/expectations.yaml:
284         Mark 16 tests as passing.
285
286 2018-12-13  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
287
288         [BigInt] Support BigInt in JSON.stringify
289         https://bugs.webkit.org/show_bug.cgi?id=192624
290
291         Reviewed by Saam Barati.
292
293         * stress/big-int-json-stringify-to-json.js: Added.
294         (shouldBe):
295         (shouldThrow):
296         (BigInt.prototype.toJSON):
297         (shouldBe.JSON.stringify):
298         * stress/big-int-json-stringify.js: Added.
299         (shouldBe):
300         (shouldThrow):
301
302 2018-12-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
303
304         [JSC] Implement "well-formed JSON.stringify" proposal
305         https://bugs.webkit.org/show_bug.cgi?id=191677
306
307         Reviewed by Darin Adler.
308
309         * stress/json-surrogate-pair.js: Added.
310         (shouldBe):
311         * test262/expectations.yaml:
312
313 2018-12-20  Keith Miller  <keith_miller@apple.com>
314
315         Add support for globalThis
316         https://bugs.webkit.org/show_bug.cgi?id=165171
317
318         Reviewed by Mark Lam.
319
320         * test262/config.yaml:
321
322 2018-12-19  Keith Miller  <keith_miller@apple.com>
323
324         Update test262 configuration to not run tests dependent on ICU version.
325         https://bugs.webkit.org/show_bug.cgi?id=192920
326
327         Reviewed by Saam Barati.
328
329         * test262/expectations.yaml:
330
331 2018-12-20  Mark Lam  <mark.lam@apple.com>
332
333         Fix a typo in slow_path_construct_arityCheck and operationConstructArityCheck.
334         https://bugs.webkit.org/show_bug.cgi?id=192939
335         <rdar://problem/46869516>
336
337         Reviewed by Keith Miller.
338
339         * stress/stack-overflow-frame-for-construct-arityCheck-should-use-construct-codeBlock.js: Added.
340
341 2018-12-20  Tadeu Zagallo  <tzagallo@apple.com>
342
343         WTF::String and StringImpl overflow MaxLength
344         https://bugs.webkit.org/show_bug.cgi?id=192853
345         <rdar://problem/45726906>
346
347         Reviewed by Mark Lam.
348
349         * stress/string-16bit-repeat-overflow.js: Added.
350         (catch):
351
352 2018-12-19  Ross Kirsling  <ross.kirsling@sony.com>
353
354         Unreviewed follow-up to r192914.
355
356         * test262/expectations.yaml:
357         Add the last 20 missing expectations.
358
359 2018-12-19  Keith Miller  <keith_miller@apple.com>
360
361         Fix test262 expectations
362         https://bugs.webkit.org/show_bug.cgi?id=192914
363
364         Unreviewed, when I imported the latest round of test262 tests I must have failed to update the test expectations.
365
366         * test262/expectations.yaml:
367
368 2018-12-19  Keith Miller  <keith_miller@apple.com>
369
370         Update test262 tests.
371         https://bugs.webkit.org/show_bug.cgi?id=192907
372
373         Rubber stamped by Mark Lam.
374
375         * test262/*: Omitted because prepare-changelog crashes.
376
377 2018-12-19  Mark Lam  <mark.lam@apple.com>
378
379         JSPropertyNameEnumerator should cache the iterated object's structure only after getting its property names.
380         https://bugs.webkit.org/show_bug.cgi?id=192464
381         <rdar://problem/46519455>
382
383         Reviewed by Saam Barati.
384
385         This patch is about a 10% speed up on the new for-in-on-object-with-lazily-materialized-properties.js
386         microbenchmark.
387
388         * microbenchmarks/for-in-on-object-with-lazily-materialized-properties.js: Added.
389         * stress/property-name-enumerator-should-cache-structure-after-getting-property-names.js: Added.
390
391 2018-12-19  Tadeu Zagallo  <tzagallo@apple.com>
392
393         String overflow in JSC::createError results in ASSERT in WTF::makeString
394         https://bugs.webkit.org/show_bug.cgi?id=192833
395         <rdar://problem/45706868>
396
397         Reviewed by Mark Lam.
398
399         * stress/string-overflow-createError.js: Added.
400
401 2018-12-18  Ross Kirsling  <ross.kirsling@sony.com>
402
403         Error message for `-x ** y` contains a typo.
404         https://bugs.webkit.org/show_bug.cgi?id=192832
405
406         Reviewed by Saam Barati.
407
408         * ChakraCore/test/UnitTestFramework/UnitTestFramework.js:
409         (assert.assert.return.throws):
410         * stress/pow-expects-update-expression-on-lhs.js:
411         (throw.new.Error):
412         Update test expectations which match against the exact error message.
413
414 2018-12-18  Mark Lam  <mark.lam@apple.com>
415
416         Gardening: test options fix.
417         https://bugs.webkit.org/show_bug.cgi?id=192822
418
419         Unreviewed.
420
421         * stress/json-stringify-string-builder-overflow.js:
422
423 2018-12-18  Mark Lam  <mark.lam@apple.com>
424
425         JSON.stringify() should throw OOM on StringBuilder overflows.
426         https://bugs.webkit.org/show_bug.cgi?id=192822
427         <rdar://problem/46670577>
428
429         Reviewed by Saam Barati.
430
431         * stress/json-stringify-string-builder-overflow.js: Added.
432
433 2018-12-18  Ross Kirsling  <ross.kirsling@sony.com>
434
435         Redeclaration of var over let/const/class should be a syntax error.
436         https://bugs.webkit.org/show_bug.cgi?id=192298
437
438         Reviewed by Keith Miller.
439
440         * test262.yaml:
441         * test262/expectations.yaml:
442         Mark 46 tests as passing.
443
444         * stress/block-scope-redeclarations.js:
445         Add some new tests.
446
447         * stress/for-in-invalidate-context-weird-assignments.js:
448         * stress/for-in-tests.js:
449         Replace tests for outdated behavior with tests for SyntaxError.
450
451         * ChakraCore/test/LetConst/defer3.baseline-jsc:
452         * ChakraCore/test/LetConst/letvar.baseline-jsc:
453         Update expectations.
454
455 2018-12-18  Mark Lam  <mark.lam@apple.com>
456
457         Skip the stress/elidable-new-object-roflcopter-then-exit.js test on 32-bit.
458         https://bugs.webkit.org/show_bug.cgi?id=191374
459         <rdar://problem/46525447>
460
461         Reviewed by Yusuke Suzuki.
462
463         This test runs too slow on 32-bit, and is not relevant for non-JIT builds.
464
465         * stress/elidable-new-object-roflcopter-then-exit.js:
466
467 2018-12-17  Mark Lam  <mark.lam@apple.com>
468
469         Skip the stress/materialized-regexp-has-correct-last-index-set-by-match.js test on 32-bit.
470         https://bugs.webkit.org/show_bug.cgi?id=192019
471         <rdar://problem/46525456>
472
473         Reviewed by Yusuke Suzuki.
474
475         The test runs too slow on 32-bit.
476
477         * stress/materialized-regexp-has-correct-last-index-set-by-match.js:
478
479 2018-12-17  Mark Lam  <mark.lam@apple.com>
480
481         Skip the stress/materialize-regexp-cyclic-regexp.js test on 32-bit.
482         https://bugs.webkit.org/show_bug.cgi?id=191373
483         <rdar://problem/46525458>
484
485         Reviewed by Yusuke Suzuki.
486
487         The test is already slow running with a JIT on 64-bit.  It will always timeout
488         on 32-bit without a JIT.
489
490         * stress/materialize-regexp-cyclic-regexp.js:
491
492 2018-12-17  Mark Lam  <mark.lam@apple.com>
493
494         Array unshift/shift should not race against the AI in the compiler thread.
495         https://bugs.webkit.org/show_bug.cgi?id=192795
496         <rdar://problem/46724263>
497
498         Reviewed by Saam Barati.
499
500         * stress/array-unshift-should-not-race-against-compiler-thread.js: Added.
501
502 2018-12-16  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
503
504         [JSC] Optimize Object.keys by caching own keys results in StructureRareData
505         https://bugs.webkit.org/show_bug.cgi?id=190047
506
507         Reviewed by Saam Barati.
508
509         * stress/object-keys-cached-zero.js: Added.
510         (shouldBe):
511         (test):
512         * stress/object-keys-changed-attribute.js: Added.
513         (shouldBe):
514         (test):
515         * stress/object-keys-changed-index.js: Added.
516         (shouldBe):
517         (test):
518         * stress/object-keys-changed.js: Added.
519         (shouldBe):
520         (test):
521         * stress/object-keys-indexed-non-cache.js: Added.
522         (shouldBe):
523         (test):
524         * stress/object-keys-overrides-get-property-names.js: Added.
525         (shouldBe):
526         (test):
527         (noInline):
528
529 2018-12-17  Mark Lam  <mark.lam@apple.com>
530
531         SamplingProfiler's isValidFramePointer() should reject address at stack origin.
532         https://bugs.webkit.org/show_bug.cgi?id=192779
533         <rdar://problem/46775869>
534
535         Reviewed by Saam Barati.
536
537         * stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js: Added.
538
539 2018-12-17  Ryan Haddad  <ryanhaddad@apple.com>
540
541         Unreviewed test gardening, address a syntax error in a new test.
542
543         * stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js:
544
545 2018-12-17  Mark Lam  <mark.lam@apple.com>
546
547         Suppress ASAN on valid stack accesses in Probe-based OSRExit::executeOSRExit().
548         https://bugs.webkit.org/show_bug.cgi?id=192776
549         <rdar://problem/46772368>
550
551         Reviewed by Keith Miller.
552
553         * stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js: Added.
554
555 2018-12-17  Mark Lam  <mark.lam@apple.com>
556
557         Fix stale assertion in attemptToForceStringArrayModeByToStringConversion().
558         https://bugs.webkit.org/show_bug.cgi?id=192770
559         <rdar://problem/46449037>
560
561         Reviewed by Keith Miller.
562
563         * stress/force-string-arrayMode-on-originalNonArray-array-class.js: Added.
564
565 2018-12-14  Mark Lam  <mark.lam@apple.com>
566
567         CallFrame::convertToStackOverflowFrame() needs to keep the top CodeBlock alive.
568         https://bugs.webkit.org/show_bug.cgi?id=192717
569         <rdar://problem/46660677>
570
571         Reviewed by Saam Barati.
572
573         * stress/regress-192717.js: Added.
574
575 2018-12-14  Commit Queue  <commit-queue@webkit.org>
576
577         Unreviewed, rolling out r239153, r239154, and r239155.
578         https://bugs.webkit.org/show_bug.cgi?id=192715
579
580         Caused flaky GC-related crashes seen with layout tests
581         (Requested by ryanhaddad on #webkit).
582
583         Reverted changesets:
584
585         "[JSC] Optimize Object.keys by caching own keys results in
586         StructureRareData"
587         https://bugs.webkit.org/show_bug.cgi?id=190047
588         https://trac.webkit.org/changeset/239153
589
590         "Unreviewed, build fix after r239153"
591         https://bugs.webkit.org/show_bug.cgi?id=190047
592         https://trac.webkit.org/changeset/239154
593
594         "Unreviewed, build fix after r239153, part 2"
595         https://bugs.webkit.org/show_bug.cgi?id=190047
596         https://trac.webkit.org/changeset/239155
597
598 2018-12-14  Keith Miller  <keith_miller@apple.com>
599
600         Callers of JSString::getIndex should check for OOM exceptions
601         https://bugs.webkit.org/show_bug.cgi?id=192709
602
603         Reviewed by Mark Lam.
604
605         * stress/StringObject-define-length-getter-rope-string-oom.js: Added.
606
607 2018-12-13  Mark Lam  <mark.lam@apple.com>
608
609         Add a missing exception check.
610         https://bugs.webkit.org/show_bug.cgi?id=192626
611         <rdar://problem/46662163>
612
613         Reviewed by Keith Miller.
614
615         * stress/regress-192626.js: Added.
616
617 2018-12-13  Caio Lima  <ticaiolima@gmail.com>
618
619         [BigInt] Add ValueDiv into DFG
620         https://bugs.webkit.org/show_bug.cgi?id=186178
621
622         Reviewed by Yusuke Suzuki.
623
624         * stress/big-int-div-jit-osr.js: Added.
625         * stress/big-int-div-jit-untyped.js: Added.
626         * stress/value-div-fixup-int32-big-int.js: Added.
627
628 2018-12-10  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
629
630         [JSC] Optimize Object.keys by caching own keys results in StructureRareData
631         https://bugs.webkit.org/show_bug.cgi?id=190047
632
633         Reviewed by Keith Miller.
634
635         * stress/object-keys-cached-zero.js: Added.
636         (shouldBe):
637         (test):
638         * stress/object-keys-changed-attribute.js: Added.
639         (shouldBe):
640         (test):
641         * stress/object-keys-changed-index.js: Added.
642         (shouldBe):
643         (test):
644         * stress/object-keys-changed.js: Added.
645         (shouldBe):
646         (test):
647         * stress/object-keys-indexed-non-cache.js: Added.
648         (shouldBe):
649         (test):
650         * stress/object-keys-overrides-get-property-names.js: Added.
651         (shouldBe):
652         (test):
653         (noInline):
654
655 2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
656
657         [DFG][FTL] Add NewSymbol
658         https://bugs.webkit.org/show_bug.cgi?id=192620
659
660         Reviewed by Saam Barati.
661
662         * microbenchmarks/symbol-creation.js: Added.
663         (test):
664         * stress/symbol-description-identity.js: Added.
665         (shouldBe):
666         (test):
667         * stress/symbol-identity.js: Added.
668         (shouldBe):
669         (test):
670         * stress/symbol-with-description-throw-error.js: Added.
671         (shouldBe):
672         (shouldThrow):
673         (test):
674         (object.toString):
675
676 2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
677
678         [BigInt] Implement DFG/FTL typeof for BigInt
679         https://bugs.webkit.org/show_bug.cgi?id=192619
680
681         Reviewed by Keith Miller.
682
683         * stress/big-int-boolean-proven-type.js: Added.
684         (assert):
685         (bool):
686         * stress/big-int-type-of-proven-type-non-constant-including-symbol.js: Added.
687         (assert):
688         (typeOf):
689         (i.switch):
690         * stress/big-int-type-of-proven-type-non-constant.js: Added.
691         (assert):
692         (typeOf):
693         * stress/big-int-type-of.js:
694         (typeOf):
695         (func):
696
697 2018-12-10  Mark Lam  <mark.lam@apple.com>
698
699         PropertyAttribute needs a CustomValue bit.
700         https://bugs.webkit.org/show_bug.cgi?id=191993
701         <rdar://problem/46264467>
702
703         Reviewed by Saam Barati.
704
705         * stress/regress-191993.js: Added.
706
707 2018-12-10  Caio Lima  <ticaiolima@gmail.com>
708
709         [BigInt] Add ValueMul into DFG
710         https://bugs.webkit.org/show_bug.cgi?id=186175
711
712         Reviewed by Yusuke Suzuki.
713
714         * stress/big-int-mul-jit-osr.js: Added.
715         * stress/big-int-mul-jit-untyped.js: Added.
716         * stress/value-mul-fixup-int32-big-int.js: Added.
717
718 2018-12-06  Keith Miller  <keith_miller@apple.com>
719
720         stress/big-wasm-memory tests failing on 32-bit JSC bot
721         https://bugs.webkit.org/show_bug.cgi?id=192020
722
723         Reviewed by Saam Barati.
724
725         Not every platform has WebAssembly, e.g. 32-bit, so we should exit
726         the wasm stress tests if the WebAssembly object does not exist.
727
728         * stress/big-wasm-memory-grow-no-max.js:
729         (test.foo):
730         (test):
731         (foo): Deleted.
732         (catch): Deleted.
733         * stress/big-wasm-memory-grow.js:
734         (test.foo):
735         (test):
736         (foo): Deleted.
737         (catch): Deleted.
738         * stress/big-wasm-memory.js:
739         (test.foo):
740         (test):
741         (foo): Deleted.
742         (catch): Deleted.
743
744 2018-12-05  Mark Lam  <mark.lam@apple.com>
745
746         speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar.
747         https://bugs.webkit.org/show_bug.cgi?id=192441
748         <rdar://problem/46480355>
749
750         Reviewed by Saam Barati.
751
752         * stress/regress-192441.js: Added.
753
754 2018-12-04  Mark Lam  <mark.lam@apple.com>
755
756         DFG's StrengthReduction phase should not reduce Construct into DirectContruct when the executable does not have constructAbility.
757         https://bugs.webkit.org/show_bug.cgi?id=192386
758         <rdar://problem/46445516>
759
760         Reviewed by Saam Barati.
761
762         * stress/regress-192386.js: Added.
763
764 2018-12-04  Caio Lima  <ticaiolima@gmail.com>
765
766         [ESNext][BigInt] Support logic operations
767         https://bugs.webkit.org/show_bug.cgi?id=179903
768
769         Reviewed by Yusuke Suzuki.
770
771         * stress/big-int-branch-usage.js: Added.
772         * stress/big-int-logical-and.js: Added.
773         * stress/big-int-logical-not.js: Added.
774         * stress/big-int-logical-or.js: Added.
775
776 2018-12-03  Ryan Haddad  <ryanhaddad@apple.com>
777
778         Unreviewed, rolling out r238833.
779
780         Breaks macOS and iOS debug builds.
781
782         Reverted changeset:
783
784         "[ESNext][BigInt] Support logic operations"
785         https://bugs.webkit.org/show_bug.cgi?id=179903
786         https://trac.webkit.org/changeset/238833
787
788 2018-12-03  Caio Lima  <ticaiolima@gmail.com>
789
790         [ESNext][BigInt] Support logic operations
791         https://bugs.webkit.org/show_bug.cgi?id=179903
792
793         Reviewed by Yusuke Suzuki.
794
795         * stress/big-int-branch-usage.js: Added.
796         * stress/big-int-logical-and.js: Added.
797         * stress/big-int-logical-not.js: Added.
798         * stress/big-int-logical-or.js: Added.
799
800 2018-12-02  Caio Lima  <ticaiolima@gmail.com>
801
802         [ESNext][BigInt] Implement support for "<<" and ">>"
803         https://bugs.webkit.org/show_bug.cgi?id=186233
804
805         Reviewed by Yusuke Suzuki.
806
807         * stress/big-int-left-shift-general.js: Added.
808         * stress/big-int-left-shift-range-error.js: Added.
809         * stress/big-int-left-shift-type-error.js: Added.
810         * stress/big-int-left-shift-wrapped-value.js: Added.
811         * stress/big-int-right-shift-general.js: Added.
812         * stress/big-int-right-shift-type-error.js: Added.
813         * stress/big-int-right-shift-wrapped-value.js: Added.
814         * stress/left-shift-to-primitive-precedence.js: Added.
815         * stress/right-shift-to-primitive-precedence.js: Added.
816
817 2018-11-30  Dean Jackson  <dino@apple.com>
818
819         Add first-class support for .mjs files in jsc binary
820         https://bugs.webkit.org/show_bug.cgi?id=192190
821         <rdar://problem/46375715>
822
823         Reviewed by Keith Miller.
824
825         * stress/simple-module.mjs: Added.
826         * stress/simple-script.js: Added.
827
828 2018-11-30  Caio Lima  <ticaiolima@gmail.com>
829
830         [BigInt] Implement ValueBitXor into DFG
831         https://bugs.webkit.org/show_bug.cgi?id=190264
832
833         Reviewed by Yusuke Suzuki.
834
835         * stress/big-int-bitwise-xor-jit.js: Added.
836         * stress/big-int-bitwise-xor-memory-stress.js: Added.
837         * stress/big-int-bitwise-xor-untyped.js: Added.
838
839 2018-11-27  Saam barati  <sbarati@apple.com>
840
841         r238510 broke scopes of size zero
842         https://bugs.webkit.org/show_bug.cgi?id=192033
843         <rdar://problem/46281734>
844
845         Reviewed by Keith Miller.
846
847         * stress/r238510-bad-loop.js: Added.
848         (foo):
849
850 2018-11-27  Mark Lam  <mark.lam@apple.com>
851
852         [Re-landing] NaNs read from Wasm code needs to be be purified.
853         https://bugs.webkit.org/show_bug.cgi?id=191056
854         <rdar://problem/45660341>
855
856         Reviewed by Filip Pizlo.
857
858         * wasm/regress/regress-191056.js: Added.
859
860 2018-11-27  Ryan Haddad  <ryanhaddad@apple.com>
861
862         Unreviewed, rolling out r238509.
863
864         Causes JSC tests to fail on iOS.
865
866         Reverted changeset:
867
868         "NaNs read from Wasm code needs to be be purified."
869         https://bugs.webkit.org/show_bug.cgi?id=191056
870         https://trac.webkit.org/changeset/238509
871
872 2018-11-26  Caio Lima  <ticaiolima@gmail.com>
873
874         Re-introduce op_bitnot
875         https://bugs.webkit.org/show_bug.cgi?id=190923
876
877         Reviewed by Yusuke Suzuki.
878
879         * stress/bit-not-must-generate.js: Added.
880         * stress/bitwise-not-no-int32.js: Added.
881
882 2018-11-26  Saam barati  <sbarati@apple.com>
883
884         InPlaceAbstractState::endBasicBlock rule for SetLocal should filter the value based on the flush format
885         https://bugs.webkit.org/show_bug.cgi?id=191956
886         <rdar://problem/45665806>
887
888         Reviewed by Yusuke Suzuki.
889
890         * stress/end-basic-block-set-local-should-filter-type.js: Added.
891         (bar):
892         (foo):
893
894 2018-11-26  Saam barati  <sbarati@apple.com>
895
896         Object allocation sinking phase needs to iterate each scope offset instead of just iterating the symbol table's hashmap when handling an activation
897         https://bugs.webkit.org/show_bug.cgi?id=191958
898         <rdar://problem/46221877>
899
900         Reviewed by Yusuke Suzuki.
901
902         * stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js: Added.
903         (x):
904         (foo):
905
906 2018-11-26  Mark Lam  <mark.lam@apple.com>
907
908         NaNs read from Wasm code needs to be be purified.
909         https://bugs.webkit.org/show_bug.cgi?id=191056
910         <rdar://problem/45660341>
911
912         Reviewed by Filip Pizlo.
913
914         * wasm/regress/regress-191056.js: Added.
915
916 2018-11-26  Michael Saboff  <msaboff@apple.com>
917
918         32-bit JSC test failure: stress/regexp-compile-oom.js
919         https://bugs.webkit.org/show_bug.cgi?id=191375
920
921         Reviewed by Mark Lam.
922
923         Disabled the test for 32 bit platforms.
924
925         * stress/regexp-compile-oom.js:
926
927 2018-11-26  Tadeu Zagallo  <tzagallo@apple.com>
928
929         ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset)
930         https://bugs.webkit.org/show_bug.cgi?id=191716
931         <rdar://problem/45723878>
932
933         Reviewed by Saam Barati.
934
935         * stress/regress-187373.js: Added.
936         (async.fn):
937
938 2018-11-21  Saam barati  <sbarati@apple.com>
939
940         DFGSpeculativeJIT should not &= exitOK with mayExit(node)
941         https://bugs.webkit.org/show_bug.cgi?id=191897
942         <rdar://problem/45871998>
943
944         Reviewed by Mark Lam.
945
946         * stress/exitok-is-not-the-same-as-mayExit.js: Added.
947         (bar):
948         (foo):
949
950 2018-11-21  Saam barati  <sbarati@apple.com>
951
952         Fix assertion in KnownCellUse inside SpeculativeJIT::speculate
953         https://bugs.webkit.org/show_bug.cgi?id=191895
954         <rdar://problem/46167406>
955
956         Reviewed by Mark Lam.
957
958         * stress/known-cell-use-needs-type-check-assertion.js: Added.
959         (foo):
960         (bar):
961
962 2018-11-21  Mark Lam  <mark.lam@apple.com>
963
964         Creating a wasm memory that is bigger than the ArrayBuffer limit but smaller than the spec limit should throw OOME not RangeError.
965         https://bugs.webkit.org/show_bug.cgi?id=191776
966         <rdar://problem/46152851>
967
968         Reviewed by Saam Barati.
969
970         * stress/big-wasm-memory-grow-no-max.js:
971         * stress/big-wasm-memory-grow.js:
972         * stress/big-wasm-memory.js:
973         - updated these to expect an OutOfMemoryError.
974
975         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: Added.
976         (Binary.prototype.emit_u8):
977         (Binary.prototype.emit_u32v):
978         (Binary.prototype.emit_header):
979         (Binary.prototype.emit_section):
980         (Binary):
981         (WasmModuleBuilder):
982         (WasmModuleBuilder.prototype.addMemory):
983         (WasmModuleBuilder.prototype.toArray):
984         (WasmModuleBuilder.prototype.toBuffer):
985         (WasmModuleBuilder.prototype.instantiate):
986         (catch):
987         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Added.
988         (catch):
989
990 2018-11-21  Caio Lima  <ticaiolima@gmail.com>
991
992         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
993         https://bugs.webkit.org/show_bug.cgi?id=190836
994
995         Reviewed by Saam Barati and Yusuke Suzuki.
996
997         * stress/big-int-out-of-memory-tests.js: Added.
998
999 2018-11-20  Mark Lam  <mark.lam@apple.com>
1000
1001         Remove invalid assertion in VMTraps::SignalSender's SignalAction.
1002         https://bugs.webkit.org/show_bug.cgi?id=191856
1003         <rdar://problem/46089992>
1004
1005         Reviewed by Yusuke Suzuki.
1006
1007         * stress/regress-191856.js: Added.
1008         - this test is skipped for now until we have a fix for webkit.org/b/191855.
1009
1010 2018-11-21  Dominik Infuehr  <dinfuehr@igalia.com>
1011
1012         Enable JIT on ARM/Linux
1013         https://bugs.webkit.org/show_bug.cgi?id=191548
1014
1015         Reviewed by Yusuke Suzuki.
1016
1017         Disable test on system with limited memory. Program was killed by
1018         the OS before the exception was thrown.
1019
1020         * slowMicrobenchmarks/function-constructor-with-huge-strings.js:
1021
1022 2018-11-20  Saam barati  <sbarati@apple.com>
1023
1024         Merging an IC variant may lead to the IC status containing overlapping structure sets
1025         https://bugs.webkit.org/show_bug.cgi?id=191869
1026         <rdar://problem/45403453>
1027
1028         Reviewed by Mark Lam.
1029
1030         * stress/merging-ic-variants-should-bail-if-structures-overlap.js: Added.
1031
1032 2018-11-19  Mark Lam  <mark.lam@apple.com>
1033
1034         globalFuncImportModule() should return a promise when it clears exceptions.
1035         https://bugs.webkit.org/show_bug.cgi?id=191792
1036         <rdar://problem/46090763>
1037
1038         Reviewed by Michael Saboff.
1039
1040         * stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js: Added.
1041
1042 2018-11-19  Guillaume Emont  <guijemont@igalia.com>
1043
1044         Skip new memory-hungry tests on memory limited devices
1045
1046         Unreviewed gardening.
1047
1048         * stress/big-wasm-memory-grow-no-max.js:
1049         * stress/big-wasm-memory-grow.js:
1050         * stress/big-wasm-memory.js:
1051
1052 2018-11-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1053
1054         Unreviewed, rolling in the rest of r237254
1055         https://bugs.webkit.org/show_bug.cgi?id=190340
1056
1057         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1058         * stress/function-cache-with-parameters-end-position.js: Added.
1059         (shouldBe):
1060         (shouldThrow):
1061         (i.anonymous):
1062         * stress/function-constructor-name.js: Added.
1063         (shouldBe):
1064         (GeneratorFunction):
1065         (AsyncFunction.async):
1066         (AsyncGeneratorFunction.async):
1067         (anonymous):
1068         (async.anonymous):
1069         * test262/expectations.yaml:
1070
1071 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
1072
1073         All users of ArrayBuffer should agree on the same max size
1074         https://bugs.webkit.org/show_bug.cgi?id=191771
1075
1076         Reviewed by Mark Lam.
1077
1078         * stress/big-wasm-memory-grow-no-max.js: Added.
1079         (foo):
1080         (catch):
1081         * stress/big-wasm-memory-grow.js: Added.
1082         (foo):
1083         (catch):
1084         * stress/big-wasm-memory.js: Added.
1085         (foo):
1086         (catch):
1087
1088 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
1089
1090         Unreviewed, make some more tests not crash my computer by only running on instance of it. These tests do not need to
1091         run for each JSC config since they're regression tests for runtime bugs.
1092
1093         * stress/json-stringified-overflow-2.js:
1094         * stress/json-stringified-overflow.js:
1095
1096 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
1097
1098         Unreviewed, make some tests not crash my computer by only running on instance of it. These tests do not need to run for each JSC
1099         config since they're regression tests for runtime bugs.
1100
1101         * stress/large-unshift-splice.js:
1102         * stress/regress-185888.js:
1103
1104 2018-11-16  Saam Barati  <sbarati@apple.com>
1105
1106         KnownCellUse should also have SpecCellCheck as its type filter
1107         https://bugs.webkit.org/show_bug.cgi?id=191729
1108         <rdar://problem/45872852>
1109
1110         Reviewed by Filip Pizlo.
1111
1112         * stress/known-cell-type-check-should-allow-empty-value-to-flow-through.js: Added.
1113         (C):
1114
1115 2018-11-16  Tadeu Zagallo  <tzagallo@apple.com>
1116
1117         Fix assertion failure on BytecodeGenerator::recordOpcode
1118         https://bugs.webkit.org/show_bug.cgi?id=191724
1119         <rdar://problem/45724395>
1120
1121         Reviewed by Saam Barati.
1122
1123         * stress/regress-187373-2.js: Added.
1124         (foo):
1125
1126 2018-11-15  Mark Lam  <mark.lam@apple.com>
1127
1128         RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.
1129         https://bugs.webkit.org/show_bug.cgi?id=191730
1130         <rdar://problem/46048517>
1131
1132         Reviewed by Saam Barati.
1133
1134         * stress/regress-187006.js: Removed.
1135           - this test is invalid because its sole purpose is to test for the non-spec
1136             compliant behavior that we just fixed.
1137
1138         * stress/regress-191730.js: Added.
1139
1140 2018-11-15  Mark Lam  <mark.lam@apple.com>
1141
1142         RegExp operations should not take fast patch if lastIndex is not numeric.
1143         https://bugs.webkit.org/show_bug.cgi?id=191731
1144         <rdar://problem/46017305>
1145
1146         Reviewed by Saam Barati.
1147
1148         * stress/regress-191731.js: Added.
1149
1150 2018-11-13  Saam Barati  <sbarati@apple.com>
1151
1152         TypeProfileLog::processLogEntries should stash away any pending exceptions and re-apply them to the VM
1153         https://bugs.webkit.org/show_bug.cgi?id=191600
1154
1155         Reviewed by Mark Lam.
1156
1157         * stress/type-profiler-log-should-defer-pending-exceptions.js: Added.
1158         (foo):
1159         (test):
1160         (bar):
1161
1162 2018-11-13  Ryan Haddad  <ryanhaddad@apple.com>
1163
1164         Unreviewed, rolling out r238132.
1165
1166         The test added with this change is timing out on Debug JSC
1167         bots.
1168
1169         Reverted changeset:
1170
1171         "[BigInt] JSBigInt::createWithLength should throw when length
1172         is greater than JSBigInt::maxLength"
1173         https://bugs.webkit.org/show_bug.cgi?id=190836
1174         https://trac.webkit.org/changeset/238132
1175
1176 2018-11-13  Mark Lam  <mark.lam@apple.com>
1177
1178         Add OOM detection to StringPrototype's substituteBackreferences().
1179         https://bugs.webkit.org/show_bug.cgi?id=191563
1180         <rdar://problem/45720428>
1181
1182         Reviewed by Saam Barati.
1183
1184         * stress/regress-191563.js: Added.
1185
1186 2018-11-13  Mark Lam  <mark.lam@apple.com>
1187
1188         LLIntSlowPath's llint_loop_osr and llint_replace should set the topCallFrame.
1189         https://bugs.webkit.org/show_bug.cgi?id=191579
1190         <rdar://problem/45942472>
1191
1192         Reviewed by Saam Barati.
1193
1194         * stress/regress-191579.js: Added.
1195
1196 2018-11-13  Caio Lima  <ticaiolima@gmail.com>
1197
1198         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
1199         https://bugs.webkit.org/show_bug.cgi?id=190836
1200
1201         Reviewed by Saam Barati.
1202
1203         * stress/big-int-out-of-memory-tests.js: Added.
1204
1205 2018-11-08  Ross Kirsling  <ross.kirsling@sony.com>
1206
1207         U+180E is no longer a whitespace character
1208         https://bugs.webkit.org/show_bug.cgi?id=191415
1209
1210         Reviewed by Saam Barati.
1211
1212         * ChakraCore/test/es5/regexSpace.baseline:
1213         * ChakraCore/test/es6/unicode_whitespace.js:
1214         Update tests to latest version.
1215         (See https://github.com/Microsoft/ChakraCore/commit/7c097b698de1e400286f9b957597b2a81fc6f80b.)
1216
1217         * test262.yaml:
1218         * test262/config.yaml:
1219         * test262/expectations.yaml:
1220         Update expectations.
1221
1222 2018-11-07  Caio Lima  <ticaiolima@gmail.com>
1223
1224         [BigInt] Add support to BigInt into ValueAdd
1225         https://bugs.webkit.org/show_bug.cgi?id=186177
1226
1227         Reviewed by Keith Miller.
1228
1229         * stress/big-int-negate-jit.js:
1230         * stress/value-add-big-int-and-string.js: Added.
1231         * stress/value-add-big-int-prediction-propagation.js: Added.
1232         * stress/value-add-big-int-untyped.js: Added.
1233
1234 2018-11-07  Tadeu Zagallo  <tzagallo@apple.com>
1235
1236         REGRESSION(r237547): Test failures on 32-bit JSC since the JIT was disabled
1237         https://bugs.webkit.org/show_bug.cgi?id=191184
1238
1239         Reviewed by Saam Barati.
1240
1241         Most tests were failing due to timeouts, since they are too slow to
1242         run on CLoop. The exceptions are:
1243
1244         proxy-get-set-correct-receiver.js: Had to reduce the recursion depth not to overflow on CLoop
1245         dont-crash-on-stack-overflow-when-parsing-builtin.js and
1246         dont-crash-on-stack-overflow-when-parsing-default-constructor.js: had
1247         to change the stack size since CLoop requires it to be page aligned.
1248
1249         * microbenchmarks/array-push-1.js:
1250         * microbenchmarks/array-push-2.js:
1251         * microbenchmarks/elidable-new-object-dag.js:
1252         * microbenchmarks/elidable-new-object-roflcopter.js:
1253         * microbenchmarks/elidable-new-object-tree.js:
1254         * microbenchmarks/getter-richards.js:
1255         * microbenchmarks/sinkable-new-object-dag.js:
1256         * microbenchmarks/string-concat-long-convert.js:
1257         * microbenchmarks/typed-array-get-set-by-val-profiling.js:
1258         * slowMicrobenchmarks/array-push-3.js:
1259         * slowMicrobenchmarks/large-map-iteration-with-additions.js:
1260         * slowMicrobenchmarks/spread-small-array.js:
1261         * slowMicrobenchmarks/undefined-property-access.js:
1262         * stress/activation-sink-default-value-tdz-error.js:
1263         * stress/activation-sink-default-value.js:
1264         * stress/activation-sink-osrexit-default-value-tdz-error.js:
1265         * stress/activation-sink-osrexit-default-value.js:
1266         * stress/activation-sink-osrexit.js:
1267         * stress/activation-sink.js:
1268         * stress/allow-math-ic-b3-code-duplication.js:
1269         * stress/array-push-multiple-int32.js:
1270         * stress/arrowfunction-activation-sink-osrexit-default-value-tdz-error.js:
1271         * stress/arrowfunction-lexical-this-activation-sink-osrexit.js:
1272         * stress/arrowfunction-lexical-this-activation-sink.js:
1273         * stress/dont-crash-on-stack-overflow-when-parsing-builtin.js:
1274         * stress/dont-crash-on-stack-overflow-when-parsing-default-constructor.js:
1275         * stress/elide-new-object-dag-then-exit.js:
1276         * stress/materialize-regexp-cyclic.js:
1277         * stress/new-regex-inline.js:
1278         * stress/op_add.js:
1279         * stress/op_bitand.js:
1280         * stress/op_bitor.js:
1281         * stress/op_bitxor.js:
1282         * stress/op_div-ConstVar.js:
1283         * stress/op_div-VarConst.js:
1284         * stress/op_div-VarVar.js:
1285         * stress/op_lshift-ConstVar.js:
1286         * stress/op_lshift-VarConst.js:
1287         * stress/op_lshift-VarVar.js:
1288         * stress/op_mod-ConstVar.js:
1289         * stress/op_mod-VarConst.js:
1290         * stress/op_mod-VarVar.js:
1291         * stress/op_mul-ConstVar.js:
1292         * stress/op_mul-VarConst.js:
1293         * stress/op_mul-VarVar.js:
1294         * stress/op_rshift-ConstVar.js:
1295         * stress/op_rshift-VarConst.js:
1296         * stress/op_rshift-VarVar.js:
1297         * stress/op_sub-ConstVar.js:
1298         * stress/op_sub-VarConst.js:
1299         * stress/op_sub-VarVar.js:
1300         * stress/op_urshift-ConstVar.js:
1301         * stress/op_urshift-VarConst.js:
1302         * stress/op_urshift-VarVar.js:
1303         * stress/proxy-get-set-correct-receiver.js:
1304         * stress/regress-179562.js:
1305         * stress/rest-parameter-many-arguments.js:
1306         * stress/sampling-profiler-richards.js:
1307         * stress/splay-flash-access-1ms.js:
1308         * stress/tailCallForwardArguments.js:
1309         * stress/typed-array-get-by-val-profiling.js:
1310         * typeProfiler/getter-richards.js:
1311
1312 2018-11-06  Michael Saboff  <msaboff@apple.com>
1313
1314         Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug and Release JSC testers.
1315         https://bugs.webkit.org/show_bug.cgi?id=191271
1316
1317         Reviewed by Saam Barati.
1318
1319         Added more test cases and made all test cases run with the same deeply recursive stack
1320         instead of finding that same point for each test case.
1321
1322         * stress/regexp-compile-oom.js:
1323         (prototype.runTest):
1324         (recurseAndTest):
1325         (testList.push.new.TestAndExpectedException):
1326
1327 2018-11-05  Michael Saboff  <msaboff@apple.com>
1328
1329         Unreviewed build fix for linux.
1330
1331         * stress/regexp-compile-oom.js: Disabled for non-darwin OSes.
1332
1333 2018-11-02  Michael Saboff  <msaboff@apple.com>
1334
1335         Rolling in r237753 with unreviewed build fix.
1336
1337         Fixed issues with DECLARE_THROW_SCOPE placement.
1338
1339 2018-11-02  Ryan Haddad  <ryanhaddad@apple.com>
1340
1341         Unreviewed, rolling out r237753.
1342
1343         Introduced JSC test failures
1344
1345         Reverted changeset:
1346
1347         "Running out of stack space not properly handled in
1348         RegExp::compile() and its callers"
1349         https://bugs.webkit.org/show_bug.cgi?id=191206
1350         https://trac.webkit.org/changeset/237753
1351
1352 2018-11-02  Michael Saboff  <msaboff@apple.com>
1353
1354         Running out of stack space not properly handled in RegExp::compile() and its callers
1355         https://bugs.webkit.org/show_bug.cgi?id=191206
1356
1357         Reviewed by Filip Pizlo.
1358
1359         New regression test.
1360
1361         * stress/regexp-compile-oom.js: Added.
1362         (recurseAndTest):
1363
1364 2018-11-01  Guillaume Emont  <guijemont@igalia.com>
1365
1366         Skip tests on arm/mips that time out now we're running on CLoop
1367
1368         Unreviewed gardening.
1369
1370         Since the JIT is temporarily disabled on 32-bit platforms, these tests
1371         time out on the bots and need to be disabled. There's more tests
1372         disabled on arm because the timeout is longer on the mips bot (as the
1373         device is slower to start with), so many of the tests don't time out
1374         there.
1375
1376         * microbenchmarks/getter-richards.js: disable on arm and mips.
1377         * stress/op_add.js: disable on arm.
1378         * stress/op_bitand.js: disable on arm.
1379         * stress/op_bitor.js: disable on arm.
1380         * stress/op_bitxor.js: disable on arm.
1381         * stress/op_lshift-ConstVar.js: disable on arm.
1382         * stress/op_lshift-VarConst.js: disable on arm.
1383         * stress/op_lshift-VarVar.js: disable on arm.
1384         * stress/op_mod-ConstVar.js: disable on arm.
1385         * stress/op_mod-VarConst.js: disable on arm.
1386         * stress/op_mod-VarVar.js: disable on arm.
1387         * stress/op_mul-ConstVar.js: disable on arm.
1388         * stress/op_mul-VarConst.js: disable on arm.
1389         * stress/op_mul-VarVar.js: disable on arm.
1390         * stress/op_rshift-ConstVar.js: disable on arm.
1391         * stress/op_rshift-VarConst.js: disable on arm.
1392         * stress/op_rshift-VarVar.js: disable on arm.
1393         * stress/op_sub-ConstVar.js: disable on arm.
1394         * stress/op_sub-VarConst.js: disable on arm.
1395         * stress/op_sub-VarVar.js: disable on arm.
1396         * stress/op_urshift-ConstVar.js: disable on arm.
1397         * stress/op_urshift-VarConst.js: disable on arm.
1398         * stress/op_urshift-VarVar.js: disable on arm.
1399         * stress/spread-forward-call-varargs-stack-overflow.js: disable on arm.
1400         * stress/value-to-boolean.js: disable on arm and mips.
1401
1402 2018-10-31  Tadeu Zagallo  <tzagallo@apple.com>
1403
1404         REGRESSION(r237547): Exception handlers should be aware of wide opcodes
1405         https://bugs.webkit.org/show_bug.cgi?id=191108
1406         <rdar://problem/45690700>
1407
1408         Reviewed by Saam Barati.
1409
1410         * stress/wide-op_catch.js: Added.
1411         (catch):
1412
1413 2018-10-29  Mark Lam  <mark.lam@apple.com>
1414
1415         Correctly detect string overflow when using the 'Function' constructor.
1416         https://bugs.webkit.org/show_bug.cgi?id=184883
1417         <rdar://problem/36320331>
1418
1419         Reviewed by Saam Barati.
1420
1421         I've verified that this passes on 32-bit as well.
1422
1423         * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.
1424
1425 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
1426
1427         Add support for GetStack FlushedDouble
1428         https://bugs.webkit.org/show_bug.cgi?id=191012
1429         <rdar://problem/45265141>
1430
1431         Reviewed by Saam Barati.
1432
1433         * stress/get-stack-double.js: Added.
1434         (bar):
1435         (noInline):
1436
1437 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
1438
1439         New bytecode format for JSC
1440         https://bugs.webkit.org/show_bug.cgi?id=187373
1441         <rdar://problem/44186758>
1442
1443         Reviewed by Filip Pizlo.
1444
1445         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
1446
1447         * stress/maximum-inline-capacity.js: Added.
1448         (test1):
1449         (test3.Foo):
1450         (test3):
1451
1452 2018-10-26  Commit Queue  <commit-queue@webkit.org>
1453
1454         Unreviewed, rolling out r237479 and r237484.
1455         https://bugs.webkit.org/show_bug.cgi?id=190978
1456
1457         broke JSC on iOS (Requested by tadeuzagallo on #webkit).
1458
1459         Reverted changesets:
1460
1461         "New bytecode format for JSC"
1462         https://bugs.webkit.org/show_bug.cgi?id=187373
1463         https://trac.webkit.org/changeset/237479
1464
1465         "Gardening: Build fix after r237479."
1466         https://bugs.webkit.org/show_bug.cgi?id=187373
1467         https://trac.webkit.org/changeset/237484
1468
1469 2018-10-26  Tadeu Zagallo  <tzagallo@apple.com>
1470
1471         New bytecode format for JSC
1472         https://bugs.webkit.org/show_bug.cgi?id=187373
1473         <rdar://problem/44186758>
1474
1475         Reviewed by Filip Pizlo.
1476
1477         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
1478
1479         * stress/maximum-inline-capacity.js: Added.
1480         (test1):
1481         (test3.Foo):
1482         (test3):
1483
1484 2018-10-26  Mark Lam  <mark.lam@apple.com>
1485
1486         Fix missing edge cases with JSGlobalObjects having a bad time.
1487         https://bugs.webkit.org/show_bug.cgi?id=189028
1488         <rdar://problem/45204939>
1489
1490         Reviewed by Saam Barati.
1491
1492         * stress/regress-189028.js: Added.
1493
1494 2018-10-22  Mark Lam  <mark.lam@apple.com>
1495
1496         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
1497         https://bugs.webkit.org/show_bug.cgi?id=190515
1498         <rdar://problem/45222379>
1499
1500         Rubber-stamped by Saam Barati.
1501
1502         Adding another test.
1503
1504         * stress/regress-190515-2.js: Added.
1505
1506 2018-10-22  Mark Lam  <mark.lam@apple.com>
1507
1508         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
1509         https://bugs.webkit.org/show_bug.cgi?id=190515
1510         <rdar://problem/45222379>
1511
1512         Reviewed by Saam Barati.
1513
1514         * stress/regress-190515.js: Added.
1515
1516 2018-10-19  Commit Queue  <commit-queue@webkit.org>
1517
1518         Unreviewed, rolling out r237254.
1519         https://bugs.webkit.org/show_bug.cgi?id=190760
1520
1521         "It regresses JetStream 2 by 5% on some iOS devices"
1522         (Requested by saamyjoon on #webkit).
1523
1524         Reverted changeset:
1525
1526         "[JSC] JSC should have "parseFunction" to optimize Function
1527         constructor"
1528         https://bugs.webkit.org/show_bug.cgi?id=190340
1529         https://trac.webkit.org/changeset/237254
1530
1531 2018-10-19  Saam Barati  <sbarati@apple.com>
1532
1533         vmCall should check if we exit before emitting an OSR exit due to exceptions
1534         https://bugs.webkit.org/show_bug.cgi?id=190740
1535         <rdar://problem/45220139>
1536
1537         Reviewed by Mark Lam.
1538
1539         * stress/dont-emit-osr-exits-for-every-call-ftl.js: Added.
1540         (foo):
1541
1542 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
1543
1544         [ESNext][BigInt] Implement support for "^"
1545         https://bugs.webkit.org/show_bug.cgi?id=186235
1546
1547         Reviewed by Yusuke Suzuki.
1548
1549         * stress/big-int-bitwise-xor-general.js: Added.
1550         * stress/big-int-bitwise-xor-to-primitive-precedence.js: Added.
1551         * stress/big-int-bitwise-xor-type-error.js: Added.
1552         * stress/big-int-bitwise-xor-wrapped-value.js: Added.
1553
1554 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
1555
1556         [BigInt] Add ValueSub into DFG
1557         https://bugs.webkit.org/show_bug.cgi?id=186176
1558
1559         Reviewed by Yusuke Suzuki.
1560
1561         * stress/big-int-subtraction-jit.js:
1562         * stress/value-sub-big-int-prediction-propagation.js: Added.
1563         * stress/value-sub-big-int-untyped.js: Added.
1564         * stress/value-sub-spec-none-case.js: Added.
1565
1566 2018-10-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1567
1568         [JSC] JSC should have "parseFunction" to optimize Function constructor
1569         https://bugs.webkit.org/show_bug.cgi?id=190340
1570
1571         Reviewed by Mark Lam.
1572
1573         This patch fixes the line number of syntax errors raised by the Function constructor,
1574         since we now parse the final code only once. And we no longer use block statement
1575         for Function constructor's parsing.
1576
1577         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1578         * stress/function-cache-with-parameters-end-position.js: Added.
1579         (shouldBe):
1580         (shouldThrow):
1581         (i.anonymous):
1582         * stress/function-constructor-name.js: Added.
1583         (shouldBe):
1584         (GeneratorFunction):
1585         (AsyncFunction.async):
1586         (AsyncGeneratorFunction.async):
1587         (anonymous):
1588         (async.anonymous):
1589         * test262/expectations.yaml:
1590
1591 2018-10-18  Commit Queue  <commit-queue@webkit.org>
1592
1593         Unreviewed, rolling out r237242.
1594         https://bugs.webkit.org/show_bug.cgi?id=190701
1595
1596         it breaks "stress/sampling-profiler-basic.js" (Requested by
1597         caiolima on #webkit).
1598
1599         Reverted changeset:
1600
1601         "[BigInt] Add ValueSub into DFG"
1602         https://bugs.webkit.org/show_bug.cgi?id=186176
1603         https://trac.webkit.org/changeset/237242
1604
1605 2018-10-17  Keith Miller  <keith_miller@apple.com>
1606
1607         AI does not clear Phantom allocation nodes.
1608         https://bugs.webkit.org/show_bug.cgi?id=190694
1609
1610         Reviewed by Saam Barati.
1611
1612         * stress/ftl-ai-filter-phantoms-should-clear-clear-value.js: Added.
1613         (Day):
1614         (DaysInYear):
1615         (TimeInYear):
1616         (TimeFromYear):
1617         (DayFromYear):
1618         (InLeapYear):
1619         (YearFromTime):
1620         (WeekDay):
1621         (DaylightSavingTA):
1622         (GetSecondSundayInMarch):
1623         (TimeInMonth):
1624
1625 2018-10-17  Caio Lima  <ticaiolima@gmail.com>
1626
1627         [BigInt] Add ValueSub into DFG
1628         https://bugs.webkit.org/show_bug.cgi?id=186176
1629
1630         Reviewed by Yusuke Suzuki.
1631
1632         * stress/big-int-subtraction-jit.js:
1633         * stress/value-sub-big-int-prediction-propagation.js: Added.
1634         * stress/value-sub-big-int-untyped.js: Added.
1635
1636 2018-10-16  Dominik Infuehr  <dinfuehr@igalia.com>
1637
1638         [JSC] stress/array-prototype-concat-of-long-spliced-arrays2.js times out on arm and mips
1639         https://bugs.webkit.org/show_bug.cgi?id=190611
1640
1641         Reviewed by Saam Barati.
1642
1643         Reduce array length just like in array-prototype-concat-of-long-spliced-arrays.js
1644         to improve test runtime. On ARM/MIPS this test even timed out when running all
1645         tests.
1646
1647         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
1648         (test):
1649
1650 2018-10-15  Guillaume Emont  <guijemont@igalia.com>
1651
1652         Skip stress/array-prototype-concat-of-long-spliced-arrays2.js on arm and mips/linux
1653
1654         Unreviewed gardening.
1655
1656         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
1657
1658 2018-10-15  Saam barati  <sbarati@apple.com>
1659
1660         Emit fjcvtzs on ARM64E on Darwin
1661         https://bugs.webkit.org/show_bug.cgi?id=184023
1662
1663         Reviewed by Yusuke Suzuki and Filip Pizlo.
1664
1665         * stress/double-to-int32-NaN.js: Added.
1666         (assert):
1667         (foo):
1668
1669 2018-10-15  Saam Barati  <sbarati@apple.com>
1670
1671         JSArray::shiftCountWithArrayStorage is wrong when an array has holes
1672         https://bugs.webkit.org/show_bug.cgi?id=190262
1673         <rdar://problem/44986241>
1674
1675         Reviewed by Mark Lam.
1676
1677         * stress/array-prototype-concat-of-long-spliced-arrays.js:
1678         (test):
1679         * stress/slice-array-storage-with-holes.js: Added.
1680         (main):
1681
1682 2018-10-15  Commit Queue  <commit-queue@webkit.org>
1683
1684         Unreviewed, rolling out r237054.
1685         https://bugs.webkit.org/show_bug.cgi?id=190593
1686
1687         "this regressed JetStream 2 by 6% on iOS" (Requested by
1688         saamyjoon on #webkit).
1689
1690         Reverted changeset:
1691
1692         "[JSC] JSC should have "parseFunction" to optimize Function
1693         constructor"
1694         https://bugs.webkit.org/show_bug.cgi?id=190340
1695         https://trac.webkit.org/changeset/237054
1696
1697 2018-10-13  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1698
1699         [JSC] JSON.stringify can accept call-with-no-arguments
1700         https://bugs.webkit.org/show_bug.cgi?id=190343
1701
1702         Reviewed by Mark Lam.
1703
1704         * stress/json-stringify-no-arguments.js: Added.
1705         (shouldBe):
1706
1707 2018-10-08  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1708
1709         [JSC] JSC should have "parseFunction" to optimize Function constructor
1710         https://bugs.webkit.org/show_bug.cgi?id=190340
1711
1712         Reviewed by Mark Lam.
1713
1714         This patch fixes the line number of syntax errors raised by the Function constructor,
1715         since we now parse the final code only once. And we no longer use block statement
1716         for Function constructor's parsing.
1717
1718         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1719         * stress/function-cache-with-parameters-end-position.js: Added.
1720         (shouldBe):
1721         (shouldThrow):
1722         (i.anonymous):
1723         * stress/function-constructor-name.js: Added.
1724         (shouldBe):
1725         (GeneratorFunction):
1726         (AsyncFunction.async):
1727         (AsyncGeneratorFunction.async):
1728         (anonymous):
1729         (async.anonymous):
1730         * test262/expectations.yaml:
1731
1732 2018-10-10  Guillaume Emont  <guijemont@igalia.com>
1733
1734         Skip JSC test stress/sampling-profiler-richards.js on armv7/linux
1735         https://bugs.webkit.org/show_bug.cgi?id=190426
1736
1737         Unreviewed gardening.
1738
1739         * stress/sampling-profiler-richards.js:
1740
1741 2018-10-06  Caio Lima  <ticaiolima@gmail.com>
1742
1743         [ESNext][BigInt] Implement support for "|"
1744         https://bugs.webkit.org/show_bug.cgi?id=186229
1745
1746         Reviewed by Yusuke Suzuki.
1747
1748         * stress/big-int-bitwise-and-jit.js:
1749         * stress/big-int-bitwise-or-general.js: Added.
1750         * stress/big-int-bitwise-or-jit-untyped.js: Added.
1751         * stress/big-int-bitwise-or-jit.js: Added.
1752         * stress/big-int-bitwise-or-memory-stress.js: Added.
1753         * stress/big-int-bitwise-or-to-primitive-precedence.js: Added.
1754         * stress/big-int-bitwise-or-type-error.js: Added.
1755         * stress/big-int-bitwise-or-wrapped-value.js: Added.
1756
1757 2018-10-05  Dominik Infuehr  <dominik.infuehr@gmail.com>
1758
1759         Skip test on systems with limited memory
1760         https://bugs.webkit.org/show_bug.cgi?id=190310
1761
1762         Invoking runDefault adds test to runlist, skipping the test in the next
1763         line does not prevent the test from executing. Change order of lines such
1764         that runDefault is only executed if test is not executed.
1765
1766         Reviewed by Mark Lam.
1767
1768         * stress/regress-190187.js:
1769
1770 2018-10-03  Saam barati  <sbarati@apple.com>
1771
1772         lowXYZ in FTLLower should always filter the type of the incoming edge
1773         https://bugs.webkit.org/show_bug.cgi?id=189939
1774         <rdar://problem/44407030>
1775
1776         Reviewed by Michael Saboff.
1777
1778         * stress/ftl-should-always-filter-for-low-type-check-functions.js: Added.
1779         (foo):
1780         (test):
1781
1782 2018-10-03  Mark Lam  <mark.lam@apple.com>
1783
1784         Make string MaxLength for all WTF and JS strings consistently equal to INT_MAX.
1785         https://bugs.webkit.org/show_bug.cgi?id=190187
1786         <rdar://problem/42512909>
1787
1788         Reviewed by Michael Saboff.
1789
1790         * stress/regress-190187.js: Added.
1791
1792 2018-10-02  Caio Lima  <ticaiolima@gmail.com>
1793
1794         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
1795         https://bugs.webkit.org/show_bug.cgi?id=190033
1796
1797         Reviewed by Yusuke Suzuki.
1798
1799         * stress/big-int-to-string.js:
1800
1801 2018-10-01  Mark Lam  <mark.lam@apple.com>
1802
1803         Function.toString() should also copy the source code Functions that are class definitions.
1804         https://bugs.webkit.org/show_bug.cgi?id=190186
1805         <rdar://problem/44733360>
1806
1807         Reviewed by Saam Barati.
1808
1809         * stress/regress-190186.js: Added.
1810
1811 2018-10-01  Dominik Infuehr  <dinfuehr@igalia.com>
1812
1813         Split NaN-check into separate test
1814         https://bugs.webkit.org/show_bug.cgi?id=190010
1815
1816         Reviewed by Saam Barati.
1817
1818         DataView exposes NaN-representation, which is not necessarily the same on each
1819         architecture. Therefore move the check of the NaN-representation into its own
1820         file such that we can disable this test on MIPS where NaN-representation can be
1821         different on older CPUs.
1822
1823         * stress/dataview-jit-set-nan.js: Added.
1824         (assert):
1825         (test.storeLittleEndian):
1826         (test.storeBigEndian):
1827         (test.store):
1828         (test):
1829         * stress/dataview-jit-set.js:
1830         (test5):
1831
1832 2018-10-01  Commit Queue  <commit-queue@webkit.org>
1833
1834         Unreviewed, rolling out r236647.
1835         https://bugs.webkit.org/show_bug.cgi?id=190124
1836
1837         Breaking test stress/big-int-to-string.js (Requested by
1838         caiolima_ on #webkit).
1839
1840         Reverted changeset:
1841
1842         "[BigInt] BigInt.proptotype.toString is broken when radix is
1843         power of 2"
1844         https://bugs.webkit.org/show_bug.cgi?id=190033
1845         https://trac.webkit.org/changeset/236647
1846
1847 2018-09-30  Caio Lima  <ticaiolima@gmail.com>
1848
1849         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
1850         https://bugs.webkit.org/show_bug.cgi?id=190033
1851
1852         Reviewed by Yusuke Suzuki.
1853
1854         * stress/big-int-to-string.js:
1855
1856 2018-09-28  Caio Lima  <ticaiolima@gmail.com>
1857
1858         [ESNext][BigInt] Implement support for "&"
1859         https://bugs.webkit.org/show_bug.cgi?id=186228
1860
1861         Reviewed by Yusuke Suzuki.
1862
1863         * stress/big-int-bitwise-and-general.js: Added.
1864         (assert):
1865         (assert.sameValue):
1866         * stress/big-int-bitwise-and-jit.js: Added.
1867         (let.assert.sameValue):
1868         (bigIntBitAnd):
1869         * stress/big-int-bitwise-and-memory-stress.js: Added.
1870         (assert):
1871         * stress/big-int-bitwise-and-to-primitive-precedence.js: Added.
1872         (assert.sameValue):
1873         (let.o.Symbol.toPrimitive):
1874         (catch):
1875         * stress/big-int-bitwise-and-type-error.js: Added.
1876         (assert):
1877         (assertThrowTypeError):
1878         (let.o.valueOf):
1879         (o.valueOf):
1880         (o.toString):
1881         (o.Symbol.toPrimitive):
1882         * stress/big-int-bitwise-and-wrapped-value.js: Added.
1883         (assert.sameValue):
1884         (testBitAnd):
1885         (let.o.Symbol.toPrimitive):
1886         (o.valueOf):
1887         (o.toString):
1888
1889 2018-09-28  Ross Kirsling  <ross.kirsling@sony.com>
1890
1891         JSC test stress/jsc-read.js doesn't support CRLF
1892         https://bugs.webkit.org/show_bug.cgi?id=190063
1893
1894         Reviewed by Yusuke Suzuki.
1895
1896         In order to run this test via Windows command prompt, we can't assume that the final newline will be LF.
1897
1898         * stress/jsc-read.js:
1899         (test):
1900
1901 2018-09-27  Saam barati  <sbarati@apple.com>
1902
1903         Verify the contents of AssemblerBuffer on arm64e
1904         https://bugs.webkit.org/show_bug.cgi?id=190057
1905         <rdar://problem/38916630>
1906
1907         Reviewed by Mark Lam.
1908
1909         * stress/regress-189132.js:
1910
1911 2018-09-27  Dominik Infuehr  <dinfuehr@igalia.com>
1912
1913         Disable test without LLInt on ARMv7
1914         https://bugs.webkit.org/show_bug.cgi?id=190037
1915
1916         Reviewed by Mark Lam.
1917
1918         Test runs out of executable memory on ARMv7, do not run
1919         this test without LLInt enabled.
1920
1921         * stress/regress-169445.js:
1922
1923 2018-09-26  Keith Miller  <keith_miller@apple.com>
1924
1925         We should zero unused property storage when rebalancing array storage.
1926         https://bugs.webkit.org/show_bug.cgi?id=188151
1927
1928         Reviewed by Michael Saboff.
1929
1930         * stress/splice-should-zero-property-storage-when-rebalancing.js: Added.
1931
1932 2018-09-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1933
1934         [JSC] Optimize Array#lastIndexOf
1935         https://bugs.webkit.org/show_bug.cgi?id=189780
1936
1937         Reviewed by Saam Barati.
1938
1939         * stress/array-lastindexof-array-prototype-trap.js: Added.
1940         (shouldBe):
1941         (AncestorArray.prototype.get 2):
1942         (AncestorArray):
1943         * stress/array-lastindexof-have-a-bad-time-c-runtime.js: Added.
1944         (shouldBe):
1945         * stress/array-lastindexof-hole-nan.js: Added.
1946         (shouldBe):
1947         (throw.new.Error):
1948         * stress/array-lastindexof-infinity.js: Added.
1949         (shouldBe):
1950         (throw.new.Error):
1951         * stress/array-lastindexof-negative-zero.js: Added.
1952         (shouldBe):
1953         (throw.new.Error):
1954         * stress/array-lastindexof-own-getter.js: Added.
1955         (shouldBe):
1956         (throw.new.Error.get array):
1957         (get array):
1958         * stress/array-lastindexof-prototype-trap.js: Added.
1959         (shouldBe):
1960         (DerivedArray.prototype.get 2):
1961         (DerivedArray):
1962
1963 2018-09-25  Saam Barati  <sbarati@apple.com>
1964
1965         Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock
1966         https://bugs.webkit.org/show_bug.cgi?id=189940
1967         <rdar://problem/43640987>
1968
1969         Reviewed by Mark Lam.
1970
1971         * stress/use-baseline-codeblock-materialize-osr-exit.js: Added.
1972
1973 2018-09-24  Saam Barati  <sbarati@apple.com>
1974
1975         Array.prototype.indexOf fast path needs to ensure the length is still valid after performing effects
1976         https://bugs.webkit.org/show_bug.cgi?id=189922
1977         <rdar://problem/44651275>
1978
1979         Reviewed by Mark Lam.
1980
1981         * stress/array-indexof-fast-path-effects.js: Added.
1982         * stress/array-indexof-cached-length.js: Added.
1983
1984 2018-09-24  Saam barati  <sbarati@apple.com>
1985
1986         ArgumentsEliminationPhase should snip basic blocks after proven OSR exits
1987         https://bugs.webkit.org/show_bug.cgi?id=189682
1988         <rdar://problem/43557315>
1989
1990         Reviewed by Mark Lam.
1991
1992         * stress/arguments-elimination-will-generate-edge-without-result.js: Added.
1993         (foo):
1994
1995 2018-09-22  Saam barati  <sbarati@apple.com>
1996
1997         The sampling should not use Strong<CodeBlock> in its machineLocation field
1998         https://bugs.webkit.org/show_bug.cgi?id=189319
1999
2000         Reviewed by Filip Pizlo.
2001
2002         * stress/sampling-profiler-richards.js: Added.
2003
2004 2018-09-19  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
2005
2006         [JSC] Optimize Array#indexOf in C++ runtime
2007         https://bugs.webkit.org/show_bug.cgi?id=189507
2008
2009         Reviewed by Saam Barati.
2010
2011         * stress/array-indexof-array-prototype-trap.js: Added.
2012         (shouldBe):
2013         (AncestorArray.prototype.get 2):
2014         (AncestorArray):
2015         * stress/array-indexof-have-a-bad-time-c-runtime.js: Added.
2016         (shouldBe):
2017         * stress/array-indexof-hole-nan.js: Added.
2018         (shouldBe):
2019         (throw.new.Error):
2020         * stress/array-indexof-infinity.js: Added.
2021         (shouldBe):
2022         (throw.new.Error):
2023         * stress/array-indexof-negative-zero.js: Added.
2024         (shouldBe):
2025         (throw.new.Error):
2026         * stress/array-indexof-own-getter.js: Added.
2027         (shouldBe):
2028         (throw.new.Error.get array):
2029         (get array):
2030         * stress/array-indexof-prototype-trap.js: Added.
2031         (shouldBe):
2032         (DerivedArray.prototype.get 2):
2033         (DerivedArray):
2034
2035 2018-09-19  Saam barati  <sbarati@apple.com>
2036
2037         AI rule for MultiPutByOffset executes its effects in the wrong order
2038         https://bugs.webkit.org/show_bug.cgi?id=189757
2039         <rdar://problem/43535257>
2040
2041         Reviewed by Michael Saboff.
2042
2043         * stress/multi-put-by-offset-must-filter-value-before-filtering-base.js: Added.
2044         (foo):
2045         (Foo):
2046         (g):
2047
2048 2018-09-17  Mark Lam  <mark.lam@apple.com>
2049
2050         Ensure that ForInContexts are invalidated if their loop local is over-written.
2051         https://bugs.webkit.org/show_bug.cgi?id=189571
2052         <rdar://problem/44402277>
2053
2054         Reviewed by Saam Barati.
2055
2056         * stress/regress-189571.js: Added.
2057
2058 2018-09-17  Saam barati  <sbarati@apple.com>
2059
2060         We must convert ProfileType to CheckStructureOrEmpty instead of CheckStructure
2061         https://bugs.webkit.org/show_bug.cgi?id=189676
2062         <rdar://problem/39682897>
2063
2064         Reviewed by Michael Saboff.
2065
2066         * typeProfiler/check-structure-or-empty-in-fixup.js: Added.
2067         (A):
2068         (K):
2069         (i.catch):
2070
2071 2018-09-14  Saam barati  <sbarati@apple.com>
2072
2073         Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed
2074         https://bugs.webkit.org/show_bug.cgi?id=189628
2075         <rdar://problem/39481690>
2076
2077         Reviewed by Mark Lam.
2078
2079         * stress/verbose-failure-dont-graph-dump-availability-already-freed.js: Added.
2080         (foo):
2081
2082 2018-09-11  Mark Lam  <mark.lam@apple.com>
2083
2084         Test for array initialization in arrayProtoFuncSplice.
2085         https://bugs.webkit.org/show_bug.cgi?id=170253
2086         <rdar://problem/31328773>
2087
2088         Rubber-stamped by Saam Barati.
2089
2090         * stress/regress-170253.js: Added.
2091
2092 2018-09-11  Mark Lam  <mark.lam@apple.com>
2093
2094         Test for IntlObject initialization.
2095         https://bugs.webkit.org/show_bug.cgi?id=170251
2096         <rdar://problem/31328419>
2097
2098         Rubber-stamped by Saam Barati.
2099
2100         * stress/regress-170251.js: Added.
2101
2102 2018-09-11  Mark Lam  <mark.lam@apple.com>
2103
2104         Test for array memcpy'ing when JSGlobalObject::haveABadTime.
2105         https://bugs.webkit.org/show_bug.cgi?id=169889
2106         <rdar://problem/31155607>
2107
2108         Reviewed by Saam Barati.
2109
2110         * stress/regress-169889-array-concat.js: Added.
2111         * stress/regress-169889-array-concat1.js: Added.
2112         * stress/regress-169889-array-slice.js: Added.
2113
2114 2018-09-11  Mark Lam  <mark.lam@apple.com>
2115
2116         Test for incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope.
2117         https://bugs.webkit.org/show_bug.cgi?id=169445
2118         <rdar://problem/30957435>
2119
2120         Reviewed by Saam Barati.
2121
2122         * stress/regress-169445.js: Added.
2123         (let.gun.eval.A):
2124         (let.gun.eval.B.C):
2125         (let.gun.eval.B.C.prototype.trigger):
2126         (let.gun.eval.B.C.prototype.triggerWithRestParameters):
2127         (let.gun.eval.B):
2128         (let.gun.eval):
2129
2130 == Rolled over to ChangeLog-2018-09-11 ==